Building Collector Plugins 1.1 - AlienVault
Building Collector Plugins 1.1 - AlienVault
Building Collector Plugins 1.1 - AlienVault
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<strong>Building</strong> <strong>Collector</strong> <strong>Plugins</strong> - Admin Guide<br />
src_ip={$src}<br />
dst_ip={resolv($sensor)}<br />
src_port={$sport}<br />
username={$user} [Rule IDs – Specific Rules]<br />
[Rule ID – Generic Rule]<br />
Example (ssh):<br />
[99 - Generic rule]<br />
# Nov 15 11:55:35 1<strong>1.1</strong>.4.9 sshd[1769702]: **********<br />
event_type=event<br />
regexp="(\SYSLOG_DATE)\s+(?P[^\s]*).*?ssh.*"<br />
plugin_sid=99<br />
date={normalize_date($1)}<br />
dst_ip={resolv($sensor)}<br />
Note: As rules are ordered alphabetically the Generic Rule has to have the highest Rule ID .<br />
2.3.4 Using Local (Plugin) Variables<br />
The different configuration variables defined in the plugin configuration file can be used with the<br />
following syntax:<br />
%()s<br />
Example:<br />
process=pads<br />
shutdown=killall -9 %(process)s<br />
2.3.5 Using Global (Agent) Variables<br />
\_CFG()<br />
Example:<br />
In the agent configuration file (/etc/ossim/agent/config.cfg):<br />
[watchdog]<br />
restart_interval=3600 ; seconds between plugin process restart<br />
In the plugin configuration file(/etc/ossim/agent/plugins/*.cfg):<br />
restart_interval=\_CFG(watchdog,restart_interval)<br />
Page 15 Copyright © Alienvault 2010
Change language